Doing business anywhere in the United States means navigating a complicated set of state laws compiled on top of regulatory guidelines. In it’s simplest form. If you manage patients personal health information (PHI) online such as booking appointment on your website. You are responsible for each patients PHI privacy and security.